Quantum correlations and secret bits 
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It is shown that (i) all entangled states can be mapped by single-copy measurements into prob- 
ability distributions containing secret correlations, and (ii) if a probability distribution obtained 
from a quantum state contains secret correlations, then this state has to be entangled. These results 
prove the existence of a two-way connection between secret and quantum correlations in the process 
of preparation. They also imply that either it is possible to map any bound entangled state into a 
distillable probability distribution or bipartite bound information exists. 
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Entanglement and secret correlations arc fundamental 
resources in Quantum Information Theory and Cryptog- 
raphy, respectively. They both share the property of be- 
ing monogamous |l| , in the sense that the more two par- 
ties share quantum or secret correlations, the less they 
are correlated to the outside world. This fact suggests 
that these two concepts are closely related. 

In the last years, several authors analyzed the link be- 
tween quantum and secret correlations. Already in 1991, 
Ekert [2} proposed a cryptography protocol whose secu- 
rity was based on the violation of a Bell inequality Q. 
More recently, this link has been exploited for proving 
the security of most of the existing quantum cryptogra- 
phy protocols, e.g. Shor-Preskill proof [J] of the security 
of the BB84 scheme [j| . Further relations were later ana- 
lyzed in 0,0 ■ A qualitative equivalence between entan- 
glement and key distillability has been shown in the cases 
of two-qubit and of one-copy distillable states 0- There 
even exist quantitative analogies: the rates of entangle- 
ment and of secret key distillability for some one-way 
communication protocols are equal |9j]. All these results 
suggested the existence of a correspondence between en- 
tanglement and secret key distillability, in the sense that 
a quantum state could be transformed into a private key 
if and only if it was distillable. However, the recent re- 
sults of [lfj have proven this statement to be false: there 
are non-distillable quantum states, also known as bound 
entangled, that are useful for establishing a secret key. 

Up to now, the connection between quantum and se- 
cret correlations has mainly been analyzed from the point 
of view of distilling or extracting these resources from 
quantum states. However, very little is known about the 
process of preparation, i.e. about the resources required 
for the formation of a quantum state or a probability 
distribution. Recall that a state of a composite quan- 
tum system is entangled if and only if it cannot be pre- 
pared by local operations and classical communication 
(LOCC), that is iff it requires truly quantum correla- 
tions (i.e. classical correlations are not sufficient for its 
preparation). In a similar way, for a given probability 
distribution, one may wonder what the cost of its dis- 



tribution is, in terms of secret bits, when only classical 
resources are used. Following [ll|, we say that a proba- 
bility distribution contains secret correlations if and only 
if it cannot be distributed using only local operations 
and public communication, that is iff it requires the use 
of a private channel, (i.e. public communication is not 
sufficient for its distribution). 

In this work we study those probability distribution de- 
rived from single-copy measurements on bipartite quan- 
tum systems. We prove that (i) all entangled states can 
be mapped by single-copy measurements into probabil- 
ity distributions containing secret correlations and (ii) if 
a probability distribution containing secret correlations 
can be derived from a state pab, then pab has to be 
entangled. Accordingly, in strong contrast to the case 
of distillability, in the preparation process there exists a 
one-to-one relation between secret and quantum correla- 
tions. As far as we know, this result represents the first 
two-way connection between these two resources, entan- 
glement and secret correlations. In particular, our results 
imply that all bound entangled states are useful to dis- 
tribute secret correlations [l2|, a task that is impossible 
using only LOCC. But let us start reviewing some basic 
facts about entanglement and secret correlations. 

In the modern theory of quantum correlations, the 
usual scenario consists of two parties, Alice and Bob, 
sharing a quantum state pab in a system <D dA <g>C ds . The 
impurity of the state is due to the coupling to the envi- 
ronment. The basic unit of entanglement is the entangled 
bit or ebit, represented by a singlet state, or maximally 
entangled state of two qubits, |* _ ) = (|01) - |10>)/>/2. 
Given pab, one would like to know (i) how many ebits 
are required for its preparation and (ii) how many ebits 
can be extracted from it by LOCC. These two funda- 
mental questions define the separability and distillability 
problems. Associated to them, there exist two entan- 
glement measures, the so-called Entan glem ent Cost, E c , 
|l3j and Distillable Entanglement, Er>, [lj|. Those states 
for which E c > require ebits for being prepared, they 
contain quantum correlations. Separable states can be 
prepared by LOCC 0, so E c = 0. 
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Moving to secret correlations, the usual scenario con- 
sists of two honest parties, Alice and Bob, and an eaves- 
dropper, Eve, having access to independent realizations 
of three random variables, X, Y and Z , characterized by 
a probability distribution P(X, Y, Z). Alice and Bob's 
symbols have some correlations, and they are also par- 
tially correlated with Eve. The basic unit is now the se- 
cret bit, that is a probability distribution P(X, Y, Z) = 
P(X, Y)P(Z) where X and Y are binary and locally ran- 
dom, P(X = Y) = 1 and Eve's symbols are decoupled 
from Alice and Bob's result. Similarly as above, given 
P(X, Y, Z), one can look for the amount of secret bits (i) 
needed for its preparation and (ii) that can be extracted 
from it by local operations and public classical com- 
munication 0, 0] ■ The corresponding measures are the 
so-called Information of Formation, If orm (X;Y\Z), pro- 
posed in as the classical analog of R, and the Secret- 
Key Rate, S(X; Y\\Z), introduced in 16]. As for the en- 
tanglement scenario, a positive information of formation 
means that the correlations P(X, Y, Z) cannot be dis- 
tributed using only local operations and public commu- 
nication, secret bits are needed. Therefore, P(X 1 _YZ) 
contains secret correlations iff If orm (X; Y\Z) > 12]. 

All these measures, Ec and Ed as well as S(X; Y\\Z) 
and If orm (X; Y\Z), have been defined from an opera- 
tional point of view and are hard to compute. For our 
purpose, it is necessary to have bounds on these quanti- 
ties. In the case of secret correlations, it is known that 
the so-called intrinsic information, I(X; Y J, Z), pro vides 
a lower bound to the information of formation yjj and 
an upper bound to the secret-key rate |l6j ] , 

S{X;Y\\Z) < I(X;Y I Z) < I form {X;Y\Z). (1) 

This function, originally introduced in [lif. is defined 
as follows: from P(X, Y, Z) one can compute for any 
Z the conditioned probability distribution P(X,Y\Z) = 
P(X, Y, Z) /P(Z). The total mutual information between 
X and Y conditioned on Z, I{X; Y\Z), is the mutual in- 
formation of P(X, Y\Z) averaged over all Z. The intrin- 
sic information then reads 



I(X;YIZ) 



min I(X;Y\Z), 
z^z 



(2) 



the minimization running over all the channels Z — > Z. 

In order to link quantum and secret correlations, we 
need two more remarks. 

First, the adversary, Eve, appears in the quantum case 
in a less explicit way than in cryptography, where her 
presence is essential for the problem to be meaningful. If 
Alice and Bob share a state Pab, the natural way of in- 
cluding Eve is to add a third system purifying it, in such a 
way that the global state of the three parties is \^abe) <= 
<£ dA ®€ dB ®C dE and p AB =tr E (\y ABE ){y ABE \). Thus, 
all the environment is conservatively associated to the ad- 
versary. Given pab, \^abe) is uniquely specified up to 
an irrelevant unitary transformation on Eve's space 
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Next, measurements are required for mapping the po- 
tential quantum correlations into probability distribu- 
tions. We denote by Mz the positive operators defin- 
ing Eve's measurement, where ^2 z Mz = 1b, and in a 
similar way Mx and My define Alice and Bob's measure- 
ments. Thus, given a state \ ^ abe) and measurements for 
each party, the corresponding probability distribution is 

P(X, Y, Z) = ti(M x ®M Y ® M z \^abe)(^abe\), (3) 
while Alice and Bob's probability distribution is 

P{X, Y)=J2 P{X, Y, Z) = tr(M x ® My Pab)- (4) 



Notice that the map © is not one-to-one, since there 
may be many choices of measurements and states lead- 
ing to the same probability distribution. And even if 
the measurements by Alice, Bob and Eve are fixed, there 
may be many states compatible with Eq. There- 
fore, P(X,Y,Z) together with M x , My and M z define 
equivalence classes in the space of states Y&abe) (lif. 

We have now introduced all the main ideas and can 
concentrate on the case where Alice and Bob perform 
local measurements Mx and My on an unknown state 
Pab ■ Assume that they can infer from their data P(X, Y) 
that the state pab is entangled. Recall that the detec- 
tion of entanglement through local measurements can 
always be done by means of an entanglement witness 
W, i.e. by measuring an observable in <C dA ® <C dn 
such that for all product states \ab), (ab\W\ab) > 0. 
Recall furthermore that all operators can be decom- 
posed into a linear combination of product operators: 
W(cxy) = ^2x y c xyMx ® My- Accordingly, when- 
ever a linear combination of Alice and Bob local mea- 
surements provides an entanglement witness W, they 
can compute its expectation value from their data: 
tr(W(c X Y)pAB) = i^x.Y^vPiX^Y). And whenever 
this expectation value is negative, Alice and Bob can 
conclude that the state pab they share is entangled. 
In such a case we say that the probability distribution, 
P(X, Y), for the measurements Mx and My, is incom- 
patible with any separable state. Actually, it was proven 
in 0] that Alice and Bob can discard any separable state 
as the origin of the observed correlations iff they can con- 
struct from their data an entanglement witness such that 
tr(W(cxY)pAB) < 0. We can now state our main result. 

Let I^abe) be a quantum state shared by Alice, Bob 
and Eve. The following two statements are equivalent: 

1. Alice and Bob's state, pab, is entangled. 

2. There exist measurements by Alice and Bob, Mx 
and My, such that for any measurement by Eve, 
M z , the corresponding probability distribution 
P{A,B,E) @ contains secret correlations. 

This result is indeed a corollary of the following theorem. 



3 



Theorem: Let P(X, Y) be a probability distribution 
shared by Alice and Bob after measuring Mx, My on a 
unknown state. Then, (i) P(X, Y), for the measurements 
Mx and My, is incompatible with any separable state Q 
if and only if (ii) for all the purifications \^abe), compat- 
ible with the observed data Q , and for all measurements 
Mz by Eve, P(X, Y, Z) contains secret correlations. 

Proof: For the (i) => (ii) part, assume that Alice 
and Bob detect the entanglement of the unknown state 
Pab used for the correlation distribution by means of an 
entanglement witness W{cxy) = J2x y c xyMx <B> My 
built from their measurements, i.e. tr(WpAB) < 0. 
The proof proceeds by contradiction. Assume that there 
is a global state |\& abe) and a measurement by Eve, 
Mz, such that the corresponding probability distribu- 
tion P{X,Y,Z) = tr(M x ® M Y ® M z \^ abe)(^ abe\) 
admits P(X, Y) as marginal, but does not contain any 
secret correlations. This implies I(X;Y J, Z) = for 
P(X, Y, Z), hence there is a channel P(Z\Z) such that 
I{X-Y\Z) = 0, i.e. 

P(X,Y\Z) = P(X\Z)P(Y\Z). (5) 

Denote by pz the state shared by Alice and Bob when 
Eve's result is Z: 

Pz = pT^M 1 ® MzI^abe^abeD, (6) 

where P(Z) = tr(l <g> M z |*asb)(*Abe|) and by tnc 
state after Eve's classical processing 

Pz = j^zZ P W P W Z ^z> ( 7 ) 

where P(Z) = J2z P ( Z ) P ( Z \ Z ) and tne positive opera- 
tors Mz — J2z P(Z\Z)Mz define another measurement, 
since Ylz = ^-E UM- From Eq. © we have that, 
VX,Y, 

tr(M x <8> Myp^) = tr(M x p AZ )tr(M Y p BZ ), (8) 

where (Pbz) denotes the state after tracing Bob 

(Alice) out in p z . Define the separable state p AB — 
T, p ( z )_Paz ® Pbz- Using that p A B = J2z p ( z )Pz = 
J2z P ( Z )Pz, it follows from Eq. © that 

tr (W pab) = tr(Wp s AB ) < 0, (9) 

which is a contradiction with the assumption that W is 
an entanglement witness. Therefore, It orm {X\Y\Z) > 
I(X;Y I Z) > for all the states |* abe) and all Eve's 
measurements. This conclude the (i) (ii) part of the 
proof. 

For the (ii) (i) part, we proceed again by contra- 
diction (see also jy, Qj|). Assume that there exists a 
separable state pab compatible with the observed data 
P(X, Y). Since pab is separable, it can be expressed as 

nz 

PAB = Y,P( z )Wzbz)(a z b z \. (10) 
z=\ 



Consider the purification 

nz 

\^abe) =J2V p J z )\azb z )\Z), (11) 

i=l 

where \^abe) € <C dA ® C df3 (g C™ z and \Z) are n z or- 
thonormal vectors. If Eve applies the measurement de- 
fined by Mz = \Z)(Z\, we have that for all Alice and 
Bob's measurements 

P(X,Y\Z) = tr{M x ® M Y \a z bz)(az b z \) = 
ti(Mx\az)(az\MM Y \bz)(bz\) = P(X\Z)P(Y \Z). (12) 

Now, it is clear that these correlations could be as well 
generated using public communication. The random 
variables X and Y are locally generated according to one 
of the nz probability distributions P(X\Z) and P(Y\Z). 
The choice among these probability distributions is made 
according to the probability distribution P(Z). Alice and 
Bob correlate this choice through the message Z that one 
of the parties generates and sends to the other through 
a public channel (or a source to both parties) . This clas- 
sical message is accessible to Eve. No secret bits are 
required for this distribution, thus I form — 0, which con- 
tradicts statement (ii) . Hence there is no separable state 
Pab compatible with the observed data P(X,Y). □ 

Corollary: Consider an entangled state pab = 
tr E {\^ abe)(^ abe\), where I^abe) denotes the global 
state including Eve. There always exist measurements 
by Alice and Bob mapping this state into a probability 
distribution containing secret correlations, independently 
of Eve's measurement. 

Proof: This easily follows from the previous Theorem 
together with two known results: (i) any entangled state 
is detected by an entanglement witness and (ii) any 
entanglement witness can be decomposed in terms of ten- 
sor product of operators defining local measurements, i.e. 
can be computed by local measurements 21] . □ 

These statements prove the announced "if and only if 
connection between secret and quantum correlations in 
the process of preparation. Note that all the proofs have 
been derived using single-copy measurements. This fact 
allows to easily translate our conclusions from entangle- 
ment based to prepare and measure protocols using the 
same ideas as in [23 (see also 0). In the following lines, 
several implications of the results are discussed. 

First, the presented connection is as strong as it could 
be. Consider that Alice and Bob are connected by an 
unknown quantum channel (share an unknown state). 
As soon as their measurements outcomes detect that the 
channel allows one to distribute entanglement, they know 
to share secrecy, no matter what Eve does 01 ■ Alice and 
Bob may not have enough information from the obtained 
measurement results for completely determine their chan- 
nel. Still, if their data are only compatible with entangle- 
ment, the observed distribution contains secret bits. On 
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the other hand, if the measured correlations are compati- 
ble with a separable state, no secret key can be extracted 
from them [lg. Indeed, from the observed data Alice and 
Bob cannot exclude that I(X; Y J, Z) = 0, which implies 
S(X;Y\\Z) = 0. Thus, any entangling channel can be 
seen as a source of privacy. 

Next, all this discussion is independent of the distilla- 
bility properties of quantum states. Indeed, the previous 
corollary provides a systematic way of mapping bound 
entangled states into probability distribution containing 
secrecy. An interesting open question is whether all these 
probability distributions are distillable into a perfect key 
(c.f. It follows from our results that at least one 

of the two following possibilities must be true (i) all 
bound entangled states can be mapped into distillable 
probability distributions or (ii) there exist classical prob- 
ability distributions having non-distillable secret corre- 
lations. In this case, they would provide examples of 
bipartite probability distributions with bound informa- 
tion, the cryptographic an alog of bound entanglement 
conjectured in [fj (see also Hit)- 

Finally, our results also shed light on what the dif- 
ferences between bound entangled states and the set of 
LOCC operations are. It is known that these states do 
not improve the fidelity of teleportation compared to 
LOCC [23. O n the other hand, there are examples of 
bound entangled states violating some inequalities for 
variance of observables that are satisfied by separable 
states .261]. Moving to secret correlations, there exist 
bound entangled states that are useful for key distribu- 
tion [Jjj- Here, it is proven that all bound entangled 
states can be transformed into probability distributions 
that, from the point of view of its secrecy features, can 
never be established by LOCC. 

To conclude, in this work we have shown the corre- 
spondence between secret and quantum correlations in 
the process of preparation. Given a probability distribu- 
tion, its formation using quantum resources needs entan- 
gled states if and only if an alternative preparation using 
classical resources requires secret bits. 
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